CVE-2026-75094

This command injection in COMFAST's CGI interface (affecting the `mbox-config` binary, specifically the SSID parameter handler) is another expression of a vulnerability class that has appeared in nearly identical form across Tenda, Mercury, TP-Link sub-products, and other consumer-grade AP manufacturers for fifteen years. The pattern is genetic, not coincidental: manufacturers in this tier develop embedded firmware without secure coding frameworks, input sanitization libraries, or review processes that flag unsanitized system() calls. When your only requirement is 'make the SSID setting work' and your development environment gives you no security APIs, the path of least resistance is direct string concatenation to OS commands. The specific function handling this request (`ptest_ssid` — note the 'ptest' prefix, which suggests test infrastructure that was never removed before production) passes the SSID parameter directly to a system call with no bounds checking or sanitization. This is not developer negligence; it's a structural outcome. A developer working without static analysis tools, secure coding libraries, or source review cannot be expected to spontaneously generate input validation for a field they think of as an opaque string. For defenders, the actionable implications are concrete. First, hunt for other forgotten test pathways in this firmware image: search for similar patterns (debug, factory, test, ptest prefixes in function names or parameters). This vulnerability class clusters around legacy test code that shipped to production. Second, recognize that the blast radius of this flaw extends far beyond the router itself — a command injection at the network gateway compromises every device behind it: laptops, phones, smart home devices, and work-from-home terminals that treat that router as their internet edge. CVSS 9.1 captures direct exploitability but underweights position. Third, understand the remediation timeline: manufacturer patch release, user download, and firmware flash (a non-trivial act for non-technical consumers) creates a years-long exposure window from disclosure to meaningful adoption. The real attack surface isn't the vulnerability — it's the unpatched installed base accumulating over that window. Given the fifteen-year recurrence pattern across second-tier manufacturers, assume this is not an isolated flaw. The absence of centralized validation layers in this binary suggests other injection points likely exist in the same firmware. Treat the CVE as a confirmed positive: if you manage COMFAST devices, conduct a full audit of CGI parameter handlers rather than patching only this endpoint.

Reviewed through automated stages and approved by a human before publication.